2025 CVEs (page 72)
Page 72 of 436 — CVEs published in 2025, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-13474 | High | 7.5 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in Menulux Software Inc. Mobile App allows Exploitation of Trusted Identifiers. This issue affe… |
CVE-2025-11220 | Medium | 6.4 | 2025-12-16 | The Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Text Path widget in all versions up to, and including, 3.33.3… |
CVE-2025-0836 | Medium | 6.3 | 2025-12-16 | Missing Authorization vulnerability in Milestone Systems XProtect VMS allows users with read-only access to Management Server to have full read/write access to… |
CVE-2025-14002 | High | 8.1 | 2025-12-16 | The WPCOM Member plugin for WordPress is vulnerable to authentication bypass via brute force in all versions up to, and including, 1.7.16. This is due to weak… |
CVE-2025-68088 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Huger for Elementor huger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-68087 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Modalier for Elementor modalier-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68086 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Reformer for Elementor reformer-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68085 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Buttoner for Elementor buttoner-elementor allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-68084 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in Nitesh Ultimate Auction ultimate-auction allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-68083 | Medium | 5.4 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Meks Meks Quick Plugin Disabler meks-quick-plugin-disabler allows Cross Site Request Forgery.This issue affe… |
CVE-2025-68082 | Medium | 5.4 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in SEMrush CY LTD Semrush Content Toolkit semrush-contentshake allows Cross Site Request Forgery.This issue aff… |
CVE-2025-68080 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Saad Iqbal User Avatar - Reloaded user-avatar-reloaded al… |
CVE-2025-68079 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Shortcodes salient-shortcodes allows… |
CVE-2025-68078 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeNectar Salient Portfolio salient-portfolio allows St… |
CVE-2025-68077 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm stockholm allows Stored XSS.This… |
CVE-2025-68076 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Select-Themes Stockholm Core stockholm-core allows Stored… |
CVE-2025-68071 | Medium | 6.5 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured… |
CVE-2025-68070 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Vektor,Inc. VK Google Job Posting Manager vk-google-job-p… |
CVE-2025-68068 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm stockholm allo… |
CVE-2025-68067 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes Stockholm Core stockholm… |
CVE-2025-68066 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PenciDesign Soledad soledad allows PHP… |
CVE-2025-68065 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in LiquidThemes Hub Core allows PHP Local… |
CVE-2025-68062 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove MinimogWP minimog allows PHP… |
CVE-2025-68061 | High | 7.5 | 2025-12-16 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThemeMove EduMall edumall allows PHP L… |
CVE-2025-68056 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup LBG Zoominoutslider lbg_zoominoutslider allo… |
CVE-2025-68055 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Themefic Hydra Booking hydra-booking allows SQL Injection… |
CVE-2025-68054 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup CountDown With Image or Video Background cou… |
CVE-2025-68053 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LambertGroup xPromoter top_bar_promoter allows Blind SQL… |
CVE-2025-67999 | High | 7.6 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Stefano Lissa Newsletter newsletter allows Blind SQL Inje… |
CVE-2025-67989 | Medium | 5.4 | 2025-12-16 | Server-Side Request Forgery (SSRF) vulnerability in LMPixels Kerge kerge allows Server Side Request Forgery.This issue affects Kerge: from n/a through <= 4.1.3. |
CVE-2025-67986 | Medium | 5.9 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins Document Library Lite document-library-lite… |
CVE-2025-67985 | Medium | 5.3 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in Barn2 Plugins Document Library Lite document-library-lite allows Exploiting Incorrectly Confi… |
CVE-2025-67983 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in osama.esh WP Visitor Statistics (Real Time Traffic) wp-st… |
CVE-2025-67976 | Medium | 6.5 | 2025-12-16 | Missing Authorization vulnerability in Bob Watu Quiz watu allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Watu Quiz… |
CVE-2025-67965 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in favethemes Homey Core homey-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-67962 | High | 7.6 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AIOSEO Plugin Team Broken Link Checker broken-link-checke… |
CVE-2025-67951 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPZOOM WPZOOM Addons for Elementor wpzoom-elementor-addon… |
CVE-2025-67950 | High | 8.5 | 2025-12-16 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Syed Balkhi All In One SEO Pack all-in-one-seo-pack allow… |
CVE-2025-67948 | Medium | 4.3 | 2025-12-16 | Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in SendPulse SendPulse Email Marketing Newsletter sendpulse-email-mark… |
CVE-2025-67929 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in templateinvaders TI WooCommerce Wishlist ti-woocommerce-wishlist allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-67912 | Medium | 6.5 | 2025-12-16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Premio Stars Testimonials stars-testimonials-with-slider-… |
CVE-2025-66167 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier lottier-gutenberg allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66166 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier for Elementor lottier-elementor allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-66165 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Lottier for WPBakery lottier-wpbakery allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66164 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Laser laser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Laser… |
CVE-2025-66163 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Masker for Elementor masker-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66162 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Spoter for Elementor spoter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66161 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Grider for Elementor grider-elementor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-66147 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in merkulove Coder for Elementor coder-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-66134 | Medium | 5.4 | 2025-12-16 | Missing Authorization vulnerability in NinjaTeam FileBird Pro filebird-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66133 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Conf… |
CVE-2025-66132 | Medium | 5.3 | 2025-12-16 | Authorization Bypass Through User-Controlled Key vulnerability in FAPI Business s.r.o. FAPI Member fapi-member allows Exploiting Incorrectly Configured Access… |
CVE-2025-66131 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in yaadsarig Yaad Sarig Payment Gateway For WC yaad-sarig-payment-gateway-for-wc allows Exploiting Incorrectly Configured A… |
CVE-2025-66130 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in etruel WP Views Counter wpecounter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2025-66129 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poc… |
CVE-2025-66128 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Brevo Sendinblue for WooCommerce woocommerce-sendinblue-newsletter-subscription allows Exploiting Incorrectly Configured… |
CVE-2025-66127 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in g5theme Essential Real Estate essential-real-estate allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-66126 | Medium | 5.3 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in wowpress.host Fix Media Library wow-media-library-fix allows Retrieve Embedded Sensitive Dat… |
CVE-2025-66125 | Medium | 5.3 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in Nitesh Ultimate Auction ultimate-auction allows Retrieve Embedded Sensitive Data.This issue… |
CVE-2025-66124 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ZEEN101 Leaky Paywall leaky-paywall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-66122 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Design Stylish Price List stylish-price-list allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-66121 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-66120 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in CatFolders CatFolders catfolders allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-64639 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP Compress WP Compress for MainWP wp-compress-mainwp allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64638 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in OnPay.io OnPay.io for WooCommerce onpay-io-for-woocommerce allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-64635 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Syed Balkhi Feeds for YouTube feeds-for-youtube allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64634 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeFusion Avada avada allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Avada: from n… |
CVE-2025-64633 | Medium | 5.3 | 2025-12-16 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in colabrio Norebro Extra norebro-extra allows Code Injection.This… |
CVE-2025-64632 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in Auctollo Google XML Sitemaps google-sitemap-generator allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64631 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-64630 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in Strategy11 Team Business Directory business-directory-plugin allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64253 | Medium | 4.9 | 2025-12-16 | Path Traversal: '.../...//' vulnerability in WordPress.org Health Check & Troubleshooting health-check allows Path Traversal.This issue affects Health Check &… |
CVE-2025-64251 | Medium | 4.9 | 2025-12-16 | Missing Authorization vulnerability in azzaroco Ultimate Learning Pro indeed-learning-pro allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-64250 | Medium | 4.7 | 2025-12-16 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in wpWax Directorist directorist allows Phishing.This issue affects Directorist: from n/a thr… |
CVE-2025-64249 | Medium | 5.3 | 2025-12-16 | Missing Authorization vulnerability in WP-EXPERTS.IN Protect WP Admin protect-wp-admin allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64248 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in emarket-design Request a Quote request-a-quote allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2025-64247 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in edmon.parker Read More & Accordion expand-maker allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-64246 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in netopsae Accessibility by AudioEye accessibility-by-audioeye allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-64245 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in ryanpcmcquen Import external attachments import-external-attachments allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-64244 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Codexpert, Inc Restrict Elementor Widgets, Columns and Sections restrict-elementor-widgets allows Exploiting Incorrectly… |
CVE-2025-64243 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-64242 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-64241 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in Imtiaz Rayhan WP Coupons and Deals wp-coupons-and-deals allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-64240 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in freshchat Freshchat freshchat allows Cross Site Request Forgery.This issue affects Freshchat: from n/a throu… |
CVE-2025-64239 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Yoav Farhi RTL Tester rtl-tester allows Cross Site Request Forgery.This issue affects RTL Tester: from n/a t… |
CVE-2025-64238 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in NicolasKulka WPS Bidouille wps-bidouille allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-64237 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Graham Quick Interest Slider quick-interest-slider allows Cross Site Request Forgery.This issue affects Quic… |
CVE-2025-59009 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in Astoundify Listify listify allows Cross Site Request Forgery.This issue affects Listify: from n/a through <=… |
CVE-2025-59001 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in ThemeNectar Salient Core salient-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58999 | Medium | 4.3 | 2025-12-16 | Cross-Site Request Forgery (CSRF) vulnerability in loopus WP Attractive Donations System - Easy Stripe & Paypal donations WP_AttractiveDonationsSystem allows C… |
CVE-2025-54045 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in CreativeMindsSolutions CM On Demand Search And Replace cm-on-demand-search-and-replace allows Exploiting Incorrectly Con… |
CVE-2025-54005 | Medium | 4.3 | 2025-12-16 | Missing Authorization vulnerability in sonalsinha21 SKT Page Builder skt-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-54004 | Low | 2.7 | 2025-12-16 | Missing Authorization vulnerability in WC Lovers WCFM – Frontend Manager for WooCommerce wc-frontend-manager allows Exploiting Incorrectly Configured Access Co… |
CVE-2025-49300 | Low | 2.7 | 2025-12-16 | Insertion of Sensitive Information Into Sent Data vulnerability in shinetheme Traveler Option Tree custom-option-tree allows Retrieve Embedded Sensitive Data.T… |
CVE-2025-13231 | Medium | 6.5 | 2025-12-16 | The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. This is due to a time… |
CVE-2025-13439 | Medium | 5.9 | 2025-12-16 | The Fancy Product Designer plugin for WordPress is vulnerable to Information Disclosure and PHAR Deserialization in all versions up to, and including, 6.4.8. T… |
CVE-2025-11991 | Medium | 5.3 | 2025-12-16 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on t… |
CVE-2025-66635 | High | 7.2 | 2025-12-16 | Stack-based buffer overflow vulnerability exists in SEIKO EPSON Web Config. Specially crafted data input by a logged-in user may execute arbitrary code. As for… |
CVE-2025-62330 | Medium | 5.9 | 2025-12-16 | HCL DevOps Deploy is susceptible to a cleartext transmission of sensitive information because the HTTP port remains accessible and does not redirect to HTTPS a… |
CVE-2025-14252 | High | 7.8 | 2025-12-16 | An Improper Access Control vulnerability in Advantech SUSI driver (susi.sys) allows attackers to read/write arbitrary memory, I/O ports, and MSRs, resulting in… |